Search code examples
macoscertificatecode-signingkernel-extension

How to code sign Mac OS X kernel extension with self signed certificate

I've tried to sign my kext using the command: 

sudo codesign -s "MyCert" -f MyKext.kext

I've created the certificate using the certificate assistance, with type "codesign". But if I validate the kext using:

kextutil -tn MyKext.kext

The following error is displayed:

Code Signing Failure: code signature is invalid

So, how to codesign a kext using an self signed certificate?

Solution

  • You can't use a self-signed certificate, essentially. If you aren't already a member, you need to join the Mac Developer Program, and then apply for a kext Developer ID (you'll need to state a reason, and it will take some weeks to be approved or denied) which gives you the required certificate.

    During development or if you're not planning to distribute your kext, you can also continue using unsgned kexts. Yosemite (10.10) requires the kernel boot argument kext-dev-mode=1 to accept these.